sestatusCheck SELinux status and mode
sestatus reports whether SELinux is enabled, which policy is loaded and whether it's enforcing or only permissive. On RHEL, Fedora and Amazon Linux it's the first command to run when a service gets 'permission denied' although the file permissions look fine.
sestatus [-v] [-b]You've logged in to a RHEL 9 server and want to know whether SELinux could be blocking things.
sestatusPrints SELinux state from /sys/fs/selinux and /etc/selinux/config.
SELinux is a Linux Security Module: on every access the kernel checks, after normal permissions, whether the process's security context (its domain, like httpd_t) may perform that action on the object's context (a type like httpd_sys_content_t or a port type like http_port_t), according to the loaded policy, usually 'targeted'. In enforcing mode a denial blocks the action with EACCES and logs an AVC record to the audit log; in permissive mode it's only logged. sestatus reads the live state from the selinuxfs filesystem mounted at /sys/fs/selinux (enforce, policyvers, booleans) and the configured mode from /etc/selinux/config, so it can show that the current mode differs from what will apply after a reboot. setenforce 0/1 switches between enforcing and permissive at runtime; disabling SELinux completely needs a kernel parameter and a reboot. Labels come from the policy's file contexts (restorecon applies them) and are stored as extended attributes on files. Ubuntu uses AppArmor instead: aa-status is its equivalent.
sestatusEnabled?, mount point, policy name, current and configured mode-vAlso show contexts of key processes and files (from /etc/sestatus.conf)-bList policy booleans and their valuesgetenforceJust the mode: Enforcing, Permissive or Disabledsetenforce 0|1Switch to permissive / enforcing until rebootls -Z / ps -eZShow SELinux contexts of files / processesausearch -m AVC -ts recentRecent denials from the audit logrestorecon -Rv PATHReset file labels to the policy defaultsetsebool -P NAME onTurn a boolean on permanentlysemanage port -a -t TYPE -p tcp NAllow a service type to use a non-standard portsetenforce 0 (or SELINUX=disabled) as the fix for a permission problemIt removes a major layer of protection for every service on the host to fix one label or port.
Find the AVC (ausearch -m AVC), then restorecon, setsebool -P or semanage portUsing mv to put files into a service's directorymv keeps the original SELinux label (user_home_t, tmp_t), which the service isn't allowed to read.
cp, or run restorecon -Rv on the target directory after movingchmod 777 to fix 'Permission denied' when sestatus says enforcingUnix permissions aren't the problem; SELinux checks are separate and still deny, and now the file is world-writable too.
ls -Z to compare labels, ausearch -m AVC -ts recent to see the denialTry these on a Linux machine of your own. Each task has a hint and a solution.
Find out whether this machine uses SELinux or AppArmor, and in which mode.
Write the commands that would let nginx on a RHEL host listen on port 8081 and connect to a backend API, without disabling SELinux.
Explain from this line what was blocked and why: avc: denied { read } for pid=912 comm="nginx" name="index.html" scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file
sestatusCheck SELinux status and mode
sestatus reports whether SELinux is enabled, which policy is loaded and whether it's enforcing or only permissive. On RHEL, Fedora and Amazon Linux it's the first command to run when a service gets 'permission denied' although the file permissions look fine.
sestatus [-v] [-b]You've logged in to a RHEL 9 server and want to know whether SELinux could be blocking things.
sestatusPrints SELinux state from /sys/fs/selinux and /etc/selinux/config.
SELinux is a Linux Security Module: on every access the kernel checks, after normal permissions, whether the process's security context (its domain, like httpd_t) may perform that action on the object's context (a type like httpd_sys_content_t or a port type like http_port_t), according to the loaded policy, usually 'targeted'. In enforcing mode a denial blocks the action with EACCES and logs an AVC record to the audit log; in permissive mode it's only logged. sestatus reads the live state from the selinuxfs filesystem mounted at /sys/fs/selinux (enforce, policyvers, booleans) and the configured mode from /etc/selinux/config, so it can show that the current mode differs from what will apply after a reboot. setenforce 0/1 switches between enforcing and permissive at runtime; disabling SELinux completely needs a kernel parameter and a reboot. Labels come from the policy's file contexts (restorecon applies them) and are stored as extended attributes on files. Ubuntu uses AppArmor instead: aa-status is its equivalent.
sestatusEnabled?, mount point, policy name, current and configured mode-vAlso show contexts of key processes and files (from /etc/sestatus.conf)-bList policy booleans and their valuesgetenforceJust the mode: Enforcing, Permissive or Disabledsetenforce 0|1Switch to permissive / enforcing until rebootls -Z / ps -eZShow SELinux contexts of files / processesausearch -m AVC -ts recentRecent denials from the audit logrestorecon -Rv PATHReset file labels to the policy defaultsetsebool -P NAME onTurn a boolean on permanentlysemanage port -a -t TYPE -p tcp NAllow a service type to use a non-standard portsetenforce 0 (or SELINUX=disabled) as the fix for a permission problemIt removes a major layer of protection for every service on the host to fix one label or port.
Find the AVC (ausearch -m AVC), then restorecon, setsebool -P or semanage portUsing mv to put files into a service's directorymv keeps the original SELinux label (user_home_t, tmp_t), which the service isn't allowed to read.
cp, or run restorecon -Rv on the target directory after movingchmod 777 to fix 'Permission denied' when sestatus says enforcingUnix permissions aren't the problem; SELinux checks are separate and still deny, and now the file is world-writable too.
ls -Z to compare labels, ausearch -m AVC -ts recent to see the denialTry these on a Linux machine of your own. Each task has a hint and a solution.
Find out whether this machine uses SELinux or AppArmor, and in which mode.
Write the commands that would let nginx on a RHEL host listen on port 8081 and connect to a backend API, without disabling SELinux.
Explain from this line what was blocked and why: avc: denied { read } for pid=912 comm="nginx" name="index.html" scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file